XML 62 R44.htm IDEA: XBRL DOCUMENT
v3.25.1

Cybersecurity Risk Management and Strategy Disclosure | 12 Months Ended
--- | ---
Mar. 31, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items] |
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | Cybersecurity is a critical component of our risk management program, given the increasing reliance on technology and potential cyber threats. Our Chief Technology Officer is leading cybersecurity risk management improvement initiatives as part of our technology strategy. Our overall cybersecurity risk management covers IT, information security and data protection risk and its objective is to avoid or minimize the impacts of threat events that could lead to penetration, disruption or misuse of our information systems and to ensure compliance with applicable legal and contractual obligations. Our cybersecurity risk management improvement initiatives are informed by regulatory guidance, industry standards (such as ISO, NIST, CIS, FAIR and others), threat intelligence feeds, internal and external audits, external consultants, and insights from cybersecurity community. Some of our subsidiaries are certified under ISO 27001, an international information security management systems standard, or undergo regular Payment Card Industry Data Security Standard (PCI) audits. Experts from our Technology Leadership Centre, under the supervision of the Chief Technology Officer, periodically review our cybersecurity risk management processes to address changing threats and conditions. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity. We employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected threats. We have established processes and systems designed to mitigate technology risk, including our corporate IT control system, to work towards a consistent minimal level of cybersecurity across all our subsidiaries. We engage in periodic or regular monitoring and assessments of our technology key infrastructure and processes using internal staff and third-party specialists utilizing methods such as penetration testing, vulnerability scanning, code, configuration reviews. risk and security assessments. We assess and manage risks, including IT and cybersecurity risks, associated with external service providers and our supply chain, utilizing methods such as security assessments, SLAs, information security and data protection contractual clauses. Our audit procedures include testing of IT and cybersecurity controls to ensure reliability. The type, maturity, and formalization of controls in our subsidiaries is informed by the level of anticipated threats and their impacts associated with each organization. We maintain an IT and cybersecurity incident management process that provides a framework for responding to actual or potential cybersecurity incidents, engagement of third parties, including external incident response professionals, and timely reporting of incidents with a material or reasonably likely material impact to our Chief Technology Officer, Chief Financial Officer, who inform other senior management members and our board of directors as appropriate. The cybersecurity incident management process facilitates coordination across multiple areas of our organization. We do not maintain insurance policies to mitigate cybersecurity risks because such insurance may not be available or may be more expensive than the perceived benefit. Further, any insurance that we may purchase to mitigate certain risks may not cover all losses. For further discussion of risks from cybersecurity threats, see the section captioned "Risks Related to Information Technology and Cybersecurity" in "Risk Factors" in Part I Item 1A of this annual report.
Cybersecurity Risk Management Processes Integrated [Flag] | true
Cybersecurity Risk Management Processes Integrated [Text Block] | Cybersecurity is a critical component of our risk management program, given the increasing reliance on technology and potential cyber threats. Our Chief Technology Officer is leading cybersecurity risk management improvement initiatives as part of our technology strategy. Our overall cybersecurity risk management covers IT, information security and data protection risk and its objective is to avoid or minimize the impacts of threat events that could lead to penetration, disruption or misuse of our information systems and to ensure compliance with applicable legal and contractual obligations. Our cybersecurity risk management improvement initiatives are informed by regulatory guidance, industry standards (such as ISO, NIST, CIS, FAIR and others), threat intelligence feeds, internal and external audits, external consultants, and insights from cybersecurity community. Some of our subsidiaries are certified under ISO 27001, an international information security management systems standard, or undergo regular Payment Card Industry Data Security Standard (PCI) audits. Experts from our Technology Leadership Centre, under the supervision of the Chief Technology Officer, periodically review our cybersecurity risk management processes to address changing threats and conditions.
Cybersecurity Risk Management Third Party Engaged [Flag] | true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false
Cybersecurity Risk Board of Directors Oversight [Text Block] | Our cybersecurity risk governance model consists of three lines of defense. Our Chief Technology Officer, supported by the experts in our Technology Leadership Centre and IT and cybersecurity teams at our subsidiaries represent the first line. Our Chief Risk Officer, supported by corporate and subsidiary risk teams, and Risk Committee of the board of directors represent the second line. The third line consists of our Controlling Department, subsidiary internal audit functions and Audit Committee of the board of directors. Our Chief Technology Officer has over 15 years of information technology experience, including over a decade in leadership positions. He is supported by IT, information security and data protection professionals from our Technology Leadership Centre with extensive experience, including from regulatory agencies. At the subsidiary level our management team has varying degrees of technology, operational and cybersecurity experience, including experience in mitigating and responding to cybersecurity incidents and managing associated risks. Our Chief Technology Officer leads cybersecurity risk management improvement initiatives as part of our technology strategy, coordinated and monitored by experts from our Technology Leadership Centre. In contrast, the program's implementation at our subsidiaries is largely delegated to the subsidiary staff. Significant subsidiaries at least annually provide updates on their implementation progress, significant cybersecurity incidents, and risks to their senior executives and the experts from our Technology Leadership Centre. The experts periodically consolidate and analyze information about the cybersecurity risk management program, cybersecurity incidents and risks, key initiatives, and other matters relating to cybersecurity processes for reporting to our Chief Technology Officer and our Chief Risk Officer. Both officers at least quarterly report to the Risk Committee of the board of directors. Our Chief Technology Officer also at least annually reports directly to the board of directors including on cybersecurity initiatives, notable incidents, and risks. Our Chief Risk Officer at least annually reports directly to the board of directors including on cybersecurity incidents and risks. Our overall cybersecurity risk management is overseen by the Risk Committee of our board of directors who assists our senior management and the board of directors with their overall risk management responsibilities. Audit or assurance procedures of Controlling Department, internal audit departments and other functions include testing of IT, information security and data protection controls. Our financial reporting department ensures financial performance reliability under U.S. regulatory requirements and provides an independent objective assurance to evaluate the effectiveness of our governance. The department is directly subordinate to the Audit Committee of our board of directors.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | Risk Committee
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | The experts periodically consolidate and analyze information about the cybersecurity risk management program, cybersecurity incidents and risks, key initiatives, and other matters relating to cybersecurity processes for reporting to our Chief Technology Officer and our Chief Risk Officer. Both officers at least quarterly report to the Risk Committee of the board of directors. Our Chief Technology Officer also at least annually reports directly to the board of directors including on cybersecurity initiatives, notable incidents, and risks. Our Chief Risk Officer at least annually reports directly to the board of directors including on cybersecurity incidents and risks.Our overall cybersecurity risk management is overseen by the Risk Committee of our board of directors who assists our senior management and the board of directors with their overall risk management responsibilities. Audit or assurance procedures of Controlling Department, internal audit departments and other functions include testing of IT, information security and data protection controls. Our financial reporting department ensures financial performance reliability under U.S. regulatory requirements and provides an independent objective assurance to evaluate the effectiveness of our governance.
Cybersecurity Risk Role of Management [Text Block] | Our cybersecurity risk governance model consists of three lines of defense. Our Chief Technology Officer, supported by the experts in our Technology Leadership Centre and IT and cybersecurity teams at our subsidiaries represent the first line. Our Chief Risk Officer, supported by corporate and subsidiary risk teams, and Risk Committee of the board of directors represent the second line. The third line consists of our Controlling Department, subsidiary internal audit functions and Audit Committee of the board of directors. Our Chief Technology Officer has over 15 years of information technology experience, including over a decade in leadership positions. He is supported by IT, information security and data protection professionals from our Technology Leadership Centre with extensive experience, including from regulatory agencies. At the subsidiary level our management team has varying degrees of technology, operational and cybersecurity experience, including experience in mitigating and responding to cybersecurity incidents and managing associated risks. Our Chief Technology Officer leads cybersecurity risk management improvement initiatives as part of our technology strategy, coordinated and monitored by experts from our Technology Leadership Centre. In contrast, the program's implementation at our subsidiaries is largely delegated to the subsidiary staff. Significant subsidiaries at least annually provide updates on their implementation progress, significant cybersecurity incidents, and risks to their senior executives and the experts from our Technology Leadership Centre. The experts periodically consolidate and analyze information about the cybersecurity risk management program, cybersecurity incidents and risks, key initiatives, and other matters relating to cybersecurity processes for reporting to our Chief Technology Officer and our Chief Risk Officer. Both officers at least quarterly report to the Risk Committee of the board of directors. Our Chief Technology Officer also at least annually reports directly to the board of directors including on cybersecurity initiatives, notable incidents, and risks. Our Chief Risk Officer at least annually reports directly to the board of directors including on cybersecurity incidents and risks.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | Our cybersecurity risk governance model consists of three lines of defense. Our Chief Technology Officer, supported by the experts in our Technology Leadership Centre and IT and cybersecurity teams at our subsidiaries represent the first line. Our Chief Risk Officer, supported by corporate and subsidiary risk teams, and Risk Committee of the board of directors represent the second line. The third line consists of our Controlling Department, subsidiary internal audit functions and Audit Committee of the board of directors.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | Our Chief Technology Officer has over 15 years of information technology experience, including over a decade in leadership positions. He is supported by IT, information security and data protection professionals from our Technology Leadership Centre with extensive experience, including from regulatory agencies. At the subsidiary level our management team has varying degrees of technology, operational and cybersecurity experience, including experience in mitigating and responding to cybersecurity incidents and managing associated risks.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | Our Chief Technology Officer leads cybersecurity risk management improvement initiatives as part of our technology strategy, coordinated and monitored by experts from our Technology Leadership Centre. In contrast, the program's implementation at our subsidiaries is largely delegated to the subsidiary staff. Significant subsidiaries at least annually provide updates on their implementation progress, significant cybersecurity incidents, and risks to their senior executives and the experts from our Technology Leadership Centre. The experts periodically consolidate and analyze information about the cybersecurity risk management program, cybersecurity incidents and risks, key initiatives, and other matters relating to cybersecurity processes for reporting to our Chief Technology Officer and our Chief Risk Officer. Both officers at least quarterly report to the Risk Committee of the board of directors. Our Chief Technology Officer also at least annually reports directly to the board of directors including on cybersecurity initiatives, notable incidents, and risks. Our Chief Risk Officer at least annually reports directly to the board of directors including on cybersecurity incidents and risks.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardOfDirectorsOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementExpertiseOfManagementResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleReportToBoardFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskManagementProcessesForAssessingIdentifyingAndManagingThreatsTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K + Details
Name: | cyd_CybersecurityRiskManagementStrategyAndGovernanceLineItems
Namespace Prefix: | cyd_
Data Type: | i:stringItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskManagementThirdPartyEngagedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskProcessForInformingBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskProcessForInformingManagementOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskRoleOfManagementTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskThirdPartyOversightAndIdentificationProcessesFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration